Toward a Theory of Everything? Exploring at the Edges of the ERM Construct
Total Page:16
File Type:pdf, Size:1020Kb
Toward a Theory of Everything? Exploring at the Edges of the ERM Construct Dr. Kathleen Locklear 2012 Enterprise Risk Management Symposium April 18-20, 2012 © 2012 Casualty Actuarial Society, Professional Risk Managers’ International Association, Society of Actuaries Toward a Theory of Everything? Exploring at the Edges of the ERM Construct Dr. Kathleen Locklear Call Paper Submitted for the 2012 ERM Symposium April 18-20, 2012 Abstract During the past 10 years, enterprise risk management (ERM) has evolved considerably into a best practice approach for identifying, managing and monitoring risk across an entire organization. At the level of theory, ERM standards and frameworks such as those created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the International Organization for Standardization, have provided guidance and a direction forward. Nevertheless, there remains no single, universally accepted ERM framework. At times, the multiplicity of approaches to ERM can produce confusion, leaving companies and practitioners alike wondering which method is “right.” Moreover, despite advances in ERM theory and practice, transboundary risk, extreme events and emerging risk continue to stretch ERM to its limits. This “stretching,” in combination with other observations regarding the current state of ERM theory and practice, suggest limitations in the ERM paradigm as it exists today. This raises several compelling questions, which are the focus of this paper. 1) What is the current state of the ERM paradigm, including its apparent limitations and boundaries, particularly with regard to extreme events and emerging risk? 2) Is it possible to have a unified ERM “theory of everything,” capable of explaining both smaller, localized risk events as well as transboundary risk and emerging risk? 3) Might it be the case that one set of laws applies to localized risk while a separate and different set of laws applies to macro-level risks such as extreme events and transboundary risk? To propose answers to these questions, this paper draws from the divergent fields of modern physics and management theory. Concepts taken from physics will include quantum mechanics, general relativity and string theory. Concepts taken from management theory will include systems theory, complexity theory, scenario planning and interdisciplinarity. In combination, these will be suggested as novel means for moving toward a more robust ERM construct. Key words: ERM, systems theory, complexity theory, scenario planning, interdisciplinarity ii Introduction. Background and Purpose Enterprise risk management (ERM) first emerged in the early 1990s, and, since then, its benefits have been increasingly touted and more companies have sought to implement ERM as a best practice standard. Nevertheless, despite the growth and evolution of ERM during the past two decades, research reveals that relatively few organizations have been successful at implementing the model and developing their ERM programs to a fully mature state (Gates 2006; Fraser and Simkins 2007). These observations suggest a paradox of sorts, where ERM is “conceptually straightforward [but] its implementation is not” (Nocco and Stulz 2006, 8). Moreover, while the benefits of ERM seem intuitive, the value of ERM oftentimes remains difficult to quantify and articulate. Although existing literature suggests numerous anticipated benefits to be derived from ERM, there is scant academic research that demonstrably supports the accomplishments of ERM (Gates 2006). Combined, these observations suggest the existence of limitations within the current state of ERM theory and practice. The purpose of this paper is to explore along the boundaries of the current ERM paradigm, in the places where existing theory and practice are seemingly being stretched to their limits. To achieve this objective, this exploratory discussion will address the following research questions: 1) What is the current state of the ERM paradigm, including its apparent limitations and boundaries with regard to extreme events and emerging risk? 2) Is it possible to have a unified ERM “theory of everything,” capable of explaining both smaller, localized risk events as well as transboundary risk and emerging risk? 1 3) Might it be the case that one set of laws applies to localized risk while a separate and different set of laws applies to macro-level risks such as extreme events and transboundary risk, and, if so, how might those be appropriately incorporated within the ERM construct? With these questions in mind, this paper will draw from the seemingly disparate disciplines of physics and management theory. By adopting this novel approach, it is hoped this paper will identify new directions for research and discourse in the areas of ERM and risk management practice. Equally important, it is hoped this paper will suggest ways in which the ERM paradigm can be enhanced through multidisciplinary dialogue that transcends the customary, artificial boundaries which exist among various academic and professional disciplines. In seeking to drive this type of dialogue, this paper has been encouraged in considerable part by the writings of Grobstein (2010), who noted, “The task is not to get it right but to get it less wrong, not to disprove existing understandings but to recognize their context-dependence, not to discover what is, but to construct from conflicting understandings previously unconceived alternative understandings.” This paper begins, in Part One, with an examination of the current state of ERM. This is achieved through a focused literature review that explores how ERM is defined, its frameworks and the current state of ERM practice. The second part of this paper examines certain other limitations (constraints) within ERM. Those limitations are explored through the discussion of several themes derived from a review of the literature. Embedded within the discussion of each theme are suggestions regarding particular 2 approaches proposed as means for further developing and evolving ERM. Finally, this paper concludes with suggestions for further areas of research. Part One. The Current State of ERM An exhaustive literature review is beyond the scope of this paper. A more targeted literature review is presented here with the objective of developing an understanding of the current state of ERM. This focused literature review will explore ERM’s current definition as well as ERM frameworks, standards and practices. Defining ERM Enterprise risk management is a relatively new area within management practice, first appearing in the mid-1990s (Dickinson 2001, 360). The term “enterprise risk management” has been attributed (Iyer, Rogers and Simkins 2010, 437) to usage by James Lam in the mid-1990s. The initial academic research on ERM came shortly thereafter with publication of the first research study by L. Lee Colquitt, Robert Hoyt and Ryan Lee in 1999 (Iyer, Rogers and Simkins 2010, 421). Given the relatively limited history of ERM, it is perhaps not entirely surprising there is no universally accepted definition for enterprise risk management. At the level of practice, the array of definitions for ERM can produce confusion, leaving companies questioning what definition is “right.” Moreover, with each definition for ERM comes a different set of implementation steps and objectives, resulting in additional ambiguity for companies that wonder if they are correctly implementing ERM. As described in more 3 detail below, the emergence of ERM frameworks and standards have provided means for achieving consistency in how ERM is defined, framed and understood. ERM Frameworks and Standards The history of ERM has been marked by the introduction of several standardized frameworks. One of the earliest of these was the Australian/New Zealand Risk Standard, which was first introduced in 1995. An updated version of this standard, called AS/NZS 4360, was subsequently introduced in 2004. That year also saw the introduction of the COSO Enterprise Risk Management Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Most recently, in November 2009, the International Organization for Standardization (ISO) published ISO 31000:2009, “Risk Management: Principles and Guidelines.” Despite the development and evolution of these risk management standards and frameworks, there remains no single and universally accepted approach to ERM. It is acknowledged that, by their nature, ERM frameworks need to be general in nature in order to be applicable across a range of industries and sectors. Moreover, ERM frameworks need also to have practical utility and be relatively easy to implement. However, a trade-off of this generality is that in their present form, ERM frameworks are best understood as management heuristics and not as theories that describe the nature of risk. In this regard, ERM frameworks are akin to what Bell (1999, 9) describes as “conceptual schema … not true or false but either useful or not.” When examining case studies of ERM implementation, it becomes apparent the experiences of various organizations vary greatly and success rates have remained 4 relatively flat over the past decade. These findings, which are discussed below as part of an exploration of the current state of ERM practice, seem to suggest a “one size fits all” approach to ERM does not work. Moreover, it is suggested here that while ERM frameworks can provide a useful starting point, the task of ERM implementation is